stellarlend-contracts/PR_BODY_SHORT.txt at main · Tek-Lizzy/stellarlend-contracts · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
## Fix #1695: Add Guardian Threshold Validation

### Problem
The `set_guardian_threshold` function had no validation, allowing:
1. Setting threshold to 0 (trivially bypasses social recovery)
2. Setting threshold > guardian count (makes recovery unachievable)

### Solution
Added validation checks that reject invalid thresholds with `InvalidGuardianConfig` error:
- Rejects `threshold == 0`
- Rejects `threshold > guardians.len()`
- Blocks threshold changes during active recovery

### Changes
- **governance.rs**: Added threshold validation (2 checks + recovery block)
- **Error enum**: Added `InvalidGuardianConfig` variant
- **Tests**: 9 comprehensive test cases covering all scenarios

### Security Impact
- ✅ Prevents recovery bypass via zero threshold
- ✅ Prevents recovery bricking via excessive threshold
- ✅ Maintains existing safety during active recovery

### Testing
All tests pass:
```bash
cargo test --lib guardian_threshold_safety_test
```

**Tests verify**:
- Zero threshold rejection
- Exceeding count rejection
- Valid threshold acceptance
- Recovery in-progress blocking
- Guardian removal safety
- Edge cases (1 of 1, unanimous)

### Breaking Changes
None - only rejects invalid states that shouldn't have been accepted.

### Related
Closes #1695

---

## Checklist
- [x] Validation prevents threshold = 0
- [x] Validation prevents threshold > count
- [x] Recovery operations remain safe
- [x] Admin auth enforced
- [x] All 9 tests pass
- [x] No breaking changes